Privacy Policy

At a glance

winterlog studio ("we") runs Dakku Drawer, an app for collecting journal decorating supplies. This policy explains how we handle personal data in the iOS and Android apps and on our website (dakku.bang9.dev).

• If you use the app without signing in, your supplies and decorated pages are stored only on this device. Only people who subscribe to save to an account sign in (with Apple or Google).
• Supply photos are cut out on your device. If you subscribe, we save the cut-out supply images, supply details, labels and decorated pages to your account.
• When you sign in, we store only the user number Apple or Google gives us, converted into an unreadable form. We don't store the email address or name that comes with Google sign-in.
• To improve the app, we send a random device ID and app usage records to our own analytics system.
• Unless you buy Remove ads or subscribe, the app shows Google AdMob ads. In the EEA, the UK and Switzerland, we request ads and send usage records only as you choose in Google's consent form.
• Our servers and storage (Cloudflare), purchase checks (RevenueCat) and ads (Google) are US companies, so personal data is transferred internationally (sent to, or viewed from, another country).

Privacy contact

We are the controller of personal data for this app, and our privacy contact is the owner, Hyungu Kang. Send privacy questions, requests to see or delete your data, and complaints to:

• Business name: winterlog studio
• Owner: Hyungu Kang
• Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Email: support@bang9.dev
• Phone: +82 10 9688 1157

What we use data for

We rely on consent only for ads and our statistics in the EEA, the UK and Switzerland, and for the advertising ID on iOS (IDFA) when you allow tracking; everything else uses the bases above. You can withdraw consent at any time as described in Device storage and SDKs.

What data we get and where from

• Sign-in (optional): the sign-in provider (Apple or Google) and the random user number the provider gives us, converted into an unreadable form. Google sign-in also passes along your email address and name, but our server reads only the user number and stores nothing else. When an account is created, a random account number and the time it was created are generated
• Saved to your account (if you subscribe): supply details (fields you fill in, such as type, name, labels and notes), labels, decorated pages, cut-out supply images
• Purchases: store receipt (product, store, amount, country, time), RevenueCat user ID (an anonymous ID if you haven't signed in, or your account number if you have), device analytics ID to link purchase records, device info the payment SDK sends with it (OS, app version, language, IP address), subscription status confirmed by our server (whether you're subscribed, when it expires). Only the stores see your card details
• Usage records (sent by the app): device analytics ID (random), app opens, features you tap and their results (short values such as add a supply, decorate, sign in, purchase, watch an ad, and count ranges), device type and app language, country of access determined from your IP address (the IP address isn't stored)
• Ads (Google AdMob SDK): advertising ID, approximate location estimated from your IP address, ad views and taps, device and app info and diagnostics, ad consent status. The SDK sends this straight from your device to Google
• Visiting our website and servers: IP address, access time, requested URL, browser or app info (used by our server provider for delivery and security; we don't store it)
• Support email: your email address and what you write

Data kept only on your device

Supply photos you take with the camera or pick from your photo library are cut out on your device (on iOS with Apple Vision, on Android with the on-device feature of Google ML Kit). We don't store or send the original photos; only the cut-out supply images are stored on your device. From your photo library, the app loads only the photos you pick, and it doesn't read the photos' location data.

Supply details, labels, decorated pages, app settings and ad counts are stored on your device. When you delete the app, this data and your ad consent answer (stored inside the app by Google's consent tool, UMP) are erased together. Your sign-in status is kept in the device's secure storage and, on iOS, may remain after you delete the app (signing out erases it).

On Android, the cut-out feature (Google ML Kit) may send feature usage statistics (values such as device and app info and processing time) from your device to Google to measure how well the feature works. Photos are not sent.

How long we keep data and how we delete it

Where the law sets a retention period, the legal basis is shown in the table, and we keep those records separately and only for that period. When the retention period ends or the purpose is fulfilled, we delete the data without delay so it can't be recovered.

• Deleting your account: when you tap Settings → Delete account in the app, we immediately delete from our servers your account, your sign-in link, the supplies and images saved to your account, and subscription check records. We also delete that account's purchase records at RevenueCat, and if you signed in with Apple, we also remove the Sign in with Apple link. Without the app, request deletion as described in Delete Your Account.
• Supplies saved to your account stay there until you delete your account, even after your subscription ends. When you delete a supply in the app, we immediately delete its image from our servers too, and keep only a mark that it was deleted so that it is also deleted on your other devices.
• Our statistics records are linked only to a device analytics ID; they can't be deleted one by one, and are deleted automatically when the retention period ends.
• Support emails are deleted from our inbox.

Who receives your data (third parties, processors, international transfers)

Third parties The companies below also use the data they receive for their own purposes, so this can count as disclosure to third parties.

• Sign-in providers and the app stores are ones you choose and have your own agreement with, so their privacy policies apply.
• If the law requires it, for example a court warrant, we disclose data only as far as the law requires.

Processors We entrust work to the providers below, and their data processing terms require our processors (those who do the processing on our behalf) to protect personal data to the same standard as this policy. Their sub-processors are listed by each provider, and if we change providers or what they do for us, we will update this policy.

We treat the ad work done by Google AdMob as work we entrust to it, so it is in the table above. In the EEA, the UK and Switzerland we only request ads after you consent, but the ad SDK starts first to show the consent form, and at that point it may send device and app information to Google.

International transfers

• When and how: whenever you use the app or website, over an encrypted connection.
• Legal basis: Korean PIPA Art. 28-8(1)(3) (processing and storage needed to perform our contract, disclosed in this policy). For users in the EEA and the UK, data is protected by the adequacy decisions for Korea and, for US providers, by the EU-US Data Privacy Framework or standard contractual clauses.
• To refuse: don't sign in or subscribe, turn off ad tracking on your device, and don't buy paid products. If you refuse, you can still add supplies and decorate on this device.

Device storage and SDKs

The app stores supplies, settings and a random device analytics ID on your device. It includes SDKs for ads (Google AdMob), purchase checks (RevenueCat) and sign-in (Apple and Google).

How Google uses information from partner apps is explained in How Google uses information from sites or apps that use our services. Google may use information collected in this app and elsewhere to measure ads and choose personalized ads, and you can opt out in your device's ad settings.

Consent and how to turn things off

• EEA, UK and Switzerland: when you open the app, we ask for consent for ads and usage records through Google's consent form (UMP). Ads and usage records are used only after you answer, as you choose. Your answer is stored inside the app; if you delete and reinstall the app, you are asked again and can answer differently.
• Korea: sending data for ads and analytics is disclosed in this policy as entrusted processing, and we don't ask for separate consent.
• United States: to opt out of sale or sharing, see Your Privacy Choices.
• iOS Allow Tracking (ATT): after you first save a supply, we ask through the App Tracking Transparency prompt; if you don't allow it, we don't use the IDFA. You can change this in Settings → Privacy & Security → Tracking.
• Advertising ID: on Android, go to Settings → Google → Ads → Delete advertising ID; on iOS, Settings → Privacy & Security → Tracking → turn off Dakku Drawer. When it's off, you see non-personalized ads.
• If you don't consent or turn things off, you can keep using the app as usual.

Information on external transmission (Japan)

Under Article 27-12 of Japan's Telecommunications Business Act, we explain what the app sends from your device to other companies.

Children's data

This app is not directed at people under 13 (under 14 in Korea; in the EEA, under the age at which you can consent to data processing on your own in your country — 13–16, depending on the country). We don't ask for your age and don't collect names or contact details. If we learn that we have collected personal data from someone below this age, we delete it. Ads are shown the same way regardless of age, and you can turn off personalized ads in your device's ad settings. Parents and guardians can ask to see or delete data through Privacy contact, and can block purchases and tracking with the store's parental controls.

Your rights and how to use them

You can ask at any time to see, correct or delete your personal data, or to stop processing it, and you can withdraw consent; where the law provides, you can also ask for a copy to take elsewhere (portability) and object to processing.

• Delete your account and the supplies saved to it: Settings → Delete account in the app, or without the app, Delete Your Account
• Erase data on your device: delete supplies or pages in the app, or delete the app
• Change ad consent or turn off the advertising ID: Device storage and SDKs
• Other requests (see or correct your data, stop processing, portability): Privacy contact

We reply within the time the law requires. We don't know your email address or name, so to find your records we may ask for your store order number. You can also make a request through a legal guardian or someone you authorize.

Your Privacy Choices

If you live in California or another US state with a similar law, you can opt out of the sale or sharing of your personal information as described below.

Do Not Sell or Share My Personal Information We don't sell personal information. When app ads (Google AdMob) send your advertising ID and ad interactions, this can count as "sharing" under some US state laws. There is no sale or sharing on our website. To opt out:

• On your device: turn off your advertising ID (Device storage and SDKs).
• Tell us: send "Do Not Sell or Share" to Privacy contact.

Global Privacy Control (GPC) Our website doesn't sell or share, so a GPC signal changes nothing. The app doesn't receive GPC signals, so please opt out as described above.

Appeals If we deny your request or you aren't happy with our answer, send "Appeal" to Privacy contact. We review it again within the time the law requires and tell you the result and our reasons; if it still isn't resolved, you can complain to your state's Attorney General.

App permissions

How we keep data safe

• All communication between the app and servers is encrypted.
• Supply photos are cut out on your device.
• We don't keep sign-in providers' user numbers as they are; we keep only a converted, unreadable form.
• Supplies saved to an account can be downloaded only by devices signed in to that account.
• Only we can access provider dashboards. Passwords and keys are kept in an encrypted secrets store.
• We collect only what we need.

Where to get help

If you need help with a privacy problem in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

Users in other countries can complain to the authorities listed in the country sections below.

Changes to this policy

This policy (version 1) was announced on November 6, 2026 and takes effect on November 6, 2026. When we change it, we announce what changed on this page, side by side with the previous version, before the change takes effect (on the effective date at the latest); if a new purpose or recipient is added, we tell you before that processing starts and ask for consent where the law requires it. Previous versions: None

Language

This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.

EEA, UK and Switzerland

• We are the controller (Privacy contact), and the legal bases are in the purposes table above: contract (GDPR 6(1)(b)), legitimate interests (6(1)(f)) and consent (6(1)(a)).
• You can object at any time to processing based on legitimate interests (service security) under GDPR Art. 21; if you do, we stop unless we have compelling grounds.
• Your rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and withdrawal of consent. Send requests to Privacy contact.
• Complaints: you can complain to the data protection authority where you live (in the UK the ICO, in Switzerland the FDPIC). UK users: if you send a complaint to us, we acknowledge it within 30 days, as the Data (Use and Access) Act 2025 requires.
• We don't make automated decisions or profiles that have legal effects on you.
• Switzerland: you have the same rights under the Federal Act on Data Protection, and transfers to US providers are protected by the Swiss-US Data Privacy Framework or standard contractual clauses.

United States (California and other state laws)

• Categories collected in the last 12 months: identifiers (account number, device analytics ID, advertising ID, RevenueCat user ID), commercial information (purchase records), internet activity (app usage records, ad interactions), content you save to your account (supply details, images), approximate location (country, estimated from IP). Sources, purposes, recipients and retention are as in the tables above.
• Selling and sharing: we don't sell personal information for money. App ads (Google AdMob) can count as "sharing"; to opt out, see Your Privacy Choices. We don't knowingly sell or share personal information of anyone under 16.
• Your rights: to know, delete, correct, and opt out of sale or sharing. We won't discriminate against you for using them, you can use an authorized agent, and we may ask you to verify your identity. To appeal a denial, follow Your Privacy Choices.
• Do Not Track: our website has no third-party tools for ads or analytics, so nothing changes based on your browser's DNT signal.
• When we update this policy, we show the effective date.

Other countries

Users in the countries below have the rights their country's law gives them. Send requests and complaints to Privacy contact. Purposes and legal bases are in the purposes table above, and international transfers in the transfer table above.

• Japan: the business handling personal information is winterlog studio (represented by Hyungu Kang; address in the privacy contact section). Security measures are in How we keep data safe, and external transmission in Information on external transmission (Japan). Foreign systems: we are in Korea, which has the Personal Information Protection Act; our providers are in the United States, which has no comprehensive federal privacy law but has state laws such as the California Consumer Privacy Act. Our providers' data processing terms set out security measures.
• Brazil: the controller (controlador) is winterlog studio, and the data protection officer (encarregado) is Hyungu Kang (Privacy contact). Legal bases (LGPD Art. 7): performance of a contract (V), legitimate interest (IX), consent (I, for ads that require consent). International transfers: Transferência internacional de dados pessoais.
• Mexico: the data controller (responsable) is winterlog studio (address in the privacy contact section). Primary purposes are storing supplies, saving to your account and checking purchases; secondary purposes are our statistics and ads. You can object to ads through your device's ad settings; our statistics cannot be turned off separately and stop being sent once you delete the app.
• Canada and India: our privacy officer (in India, grievance officer) is the owner, Hyungu Kang (Privacy contact).

International Transfers of Personal Data (Brazil)

Personal data of users in Brazil is transferred outside Brazil as follows.

• Recipients: us (winterlog studio, Korea) and the providers in the table (United States).
• Mechanism and legal basis: transfers needed to perform our contract (LGPD Art. 33, IX), providers' data processing terms and standard contractual clauses (Art. 33, II), and consent for ads that require it (Art. 33, VIII).
• Purposes and duration: see the purposes and retention tables in the Privacy Policy.
• Responsibility: we are responsible for protecting the transferred data.
• Your rights: you have the same LGPD Art. 18 rights; send requests to support@bang9.dev.
• Onward transfers: providers can pass data to their own sub-processors and the same level of protection is required by contract.